EP2012241A1 - Verfahren und System zur Erkennung unerwünschter Inferenzen von Dokumenten - Google Patents

Verfahren und System zur Erkennung unerwünschter Inferenzen von Dokumenten Download PDF

Info

Publication number
EP2012241A1
EP2012241A1 EP08101978A EP08101978A EP2012241A1 EP 2012241 A1 EP2012241 A1 EP 2012241A1 EP 08101978 A EP08101978 A EP 08101978A EP 08101978 A EP08101978 A EP 08101978A EP 2012241 A1 EP2012241 A1 EP 2012241A1
Authority
EP
European Patent Office
Prior art keywords
knowledge
documents
document
words
phrases
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP08101978A
Other languages
English (en)
French (fr)
Other versions
EP2012241B1 (de
Inventor
Jessica N Staddon
Philippe Jean-Paul Golle
Bryce Zimny
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Palo Alto Research Center Inc
Original Assignee
Palo Alto Research Center Inc
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Palo Alto Research Center Inc filed Critical Palo Alto Research Center Inc
Publication of EP2012241A1 publication Critical patent/EP2012241A1/de
Application granted granted Critical
Publication of EP2012241B1 publication Critical patent/EP2012241B1/de
Ceased legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16H—HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA
    • G16H10/00—ICT specially adapted for the handling or processing of patient-related medical or healthcare data
    • G16H10/60—ICT specially adapted for the handling or processing of patient-related medical or healthcare data for patient-specific data, e.g. for electronic patient records
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
    • G06F16/33—Querying
    • G06F16/332—Query formulation
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
    • G—PHYSICS
    • G16—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS
    • G16Z—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR SPECIFIC APPLICATION FIELDS, NOT OTHERWISE PROVIDED FOR
    • G16Z99/00—Subject matter not provided for in other main groups of this subclass

Definitions

  • the present invention relates to the design of intelligent data processing. More specifically, the present invention relates to a method and system for detecting undesirable inferences that can be drawn from a set of documents.
  • a computer system for detecting inferences from documents comprises:
  • One embodiment of the present invention provides a system that detects inferences from documents.
  • the system receives one or more documents and extracts a first set of knowledge relevant to the documents.
  • the system further formulates one or more queries to one or more reference corpora based on the first set of knowledge.
  • the system then extracts a second set of knowledge from results received in response to the queries.
  • the system produces a mapping relationship between at least one document and a piece of the second set of knowledge which is not within the first set of knowledge, the mapping relationship indicating an inference from the documents.
  • a method for detecting inferences from documents comprises receiving one or more documents; extracting a first set of knowledge relevant to the documents; formulating one or more queries to one or more reference corpora based on the first set of knowledge; extracting a second set of knowledge from results received in response to the queries; and producing a mapping relationship between at least one document and a piece of the second set of knowledge which is not within the first set of knowledge, the mapping relationship indicating an inference from the documents.
  • extracting the first set of knowledge relevant to the document involves deriving a set of words or phrases relevant to each document.
  • deriving the set of words or phrases involves determining a term-frequency inverse-document-frequency (TF.IDF) weight for a word or phrase contained in the document.
  • TF.IDF term-frequency inverse-document-frequency
  • extracting the first set of knowledge involves extracting a set of words or phrases from each document. Furthermore, formulating the queries involves constructing single-word queries, multi-word queries, or both from the extracted words or phrases.
  • extracting a set of words or phrases from each document involves extracting a pre-determined number of words or phrases from the document.
  • the system retrieves a pre-determined number of results for each query.
  • the system receives a set of sensitive knowledge relevant to the documents.
  • the piece of the second set of knowledge mapped to the document is also within the set of sensitive knowledge.
  • producing the mapping relationship involves determining an intersection between the set of sensitive knowledge and the second set of knowledge.
  • Constructing the queries may further comprise applying one or more pre-determined logical formulas to the extracted words or phrases, while extracting a set of words or phrases from each document may comprise extracting a pre-determined number of words or phrases from the document.
  • the method further comprises retrieving a pre-determined number of results for each query.
  • the method may further comprise receiving a set of sensitive knowledge relevant to the documents; wherein the piece of the second set of knowledge mapped to the document is also within the set of sensitive knowledge; and wherein producing the mapping relationship comprises determining an intersection between the set of sensitive knowledge and the second set of knowledge.
  • mapping relationship comprises presenting one or more words or phrases from the documents, which words or phrases correspond to the first set of knowledge, and one or more sensitive words or phrases extracted from the query results.
  • the method may further comprise:
  • the method may further comprise selecting the one or more reference corpora based on the documents, an intended audience, or both.
  • the inference is an undesired inference which can be extracted from a union of the document and the corpus and which cannot be extracted from the document or the corpus alone.
  • mapping relationship involves presenting one or more words or phrases from the documents, wherein these words or phrases correspond to the first set of knowledge, and one or more sensitive words or phrases extracted from the query results.
  • the system determines a ratio of: the number of results returned by a first query based on one or more words or phrases from the documents and one or more sensitive words or phrases, to the number of results returned by a second query based on one or more words or phrases from the documents.
  • the system further determines an inference from the one or more words or phrases used to generate the first query based on the size of the ratio.
  • the system selects the one or more reference corpora based on the documents, an intended audience, or both.
  • the inference is an undesired inference which can be extracted from a union of the document and the corpus and which cannot be extracted from the document or the corpus alone
  • FIG. 1 illustrates an exemplary redacted public document.
  • FIG. 2 illustrates exemplary search results from queries based on the published document illustrated in FIG. 1 .
  • FIG. 3 presents an exemplary block diagram illustrating the process of Web-based inference detection in accordance with an embodiment of the present invention.
  • FIG. 4 presents an exemplary flow chart illustrating the process of Web-based inference detection in accordance with an embodiment of the present invention.
  • FIG. 5 illustrates a computer system for facilitating Web-based inference detection in accordance with one embodiment of the present invention.
  • FIG. 6 illustrates a set of inference-detection results for identifying individuals in California in accordance with one embodiment of the present invention.
  • FIG. 7 illustrates a set of inference-detection results for identifying individuals in Illinois in accordance with one embodiment of the present invention.
  • FIG. 8 presents a summary of an experiment to identify keywords enabling STD inferences in accordance with one embodiment of the present invention.
  • FIG. 9 presents a summary of an experiment to identify keywords enabling alcoholism inferences in accordance with one embodiment of the present invention.
  • TABLE 1 presents excerpts from a de-anonymization experiment based on an inference-detection model in accordance with one embodiment of the present invention.
  • a computer-readable storage medium which may be any device or medium that can store code and/or data for use by a computer system.
  • Embodiments of the present invention provide a system for detecting undesired inferences from one or more documents.
  • the risk of undesired inferences arises when a private document becomes partially public, and when such partial disclosure allows the public to infer certain information intended to remain private.
  • a system that detects such undesired inferences can benefit a wide range of industries.
  • documents protected by attorney-client privilege are generally redacted to protect parties' private information.
  • sensitive information such as HIV status, drug or alcohol abuse, and mental health conditions, from medical records prior to releasing them.
  • anonymous bloggers are a good example of people who value anonymity.
  • remaining anonymous can be challenging, because a small amount of personal information may suffice to infer one's identity with the help of powerful search engines.
  • the challenge is not only access control, but also inference control.
  • the problem is to determine what information can be released publicly without compromising certain secrets. That is, which portion of the information can be disclosed. What makes this problem difficult is the quantity and complexity of inferences that arise when published data is combined with, and interpreted against, the backdrop of public knowledge and outside data.
  • Embodiments of the present invention provide a system for inference detection.
  • This system operates not only in a restricted setting, for example with database tables or other forms of structured data, but also in all its generality with unstructured data.
  • the underlying operation principle is that the Web, or any pool of knowledge, works equally well for generating inferences and detecting inferences.
  • the system first extracts salient keywords from the private data intended for release. Then, the system issues search queries for documents that match subsets of these keywords, within a reference corpus (such as the public Web) that encapsulates as much of relevant public knowledge as possible. The system subsequently parses the documents returned by the search queries and identifies keywords not present in the original to-be-released data. These additional keywords facilitate an estimation of the likelihood of certain inferences. The system then flags potentially dangerous inferences for manual review.
  • a reference corpus such as the public Web
  • corpus refers to a collection of documents.
  • the corpus can include all the documents available on the Web. Additionally, the system can operate based on one or more corpora.
  • “Documents” are understood here to be any form of content, including textual documents, spreadsheets, presentations, images, video, audio, multimedia, presentations, and so forth.
  • a document can be paper-based or electronic.
  • C denote a private collection of documents considered for public release
  • R denote a corpus or a collection of corpora.
  • a corpus is a collection of reference documents.
  • collection C can include the blog entries of a writer
  • collection R can include all the documents publicly available on the Web.
  • K ( C ) denote all the knowledge that can be computed from private collection C.
  • the set K ( C ) represents all the statements and facts that can be derived from the information contained in collection C .
  • the set K ( C ) can be computed with a complete and sound theorem prover given all the axioms in C . In practice, however, the costs for such computation can be prohibitively high. Therefore, one embodiment of the present invention uses an approximate representation of K ( C ).
  • K ( R ) denote all the knowledge that can be computed from the reference collection R .
  • Undesired inferences can arise when the knowledge that can be extracted from the union of the private and reference collections, K ( C ⁇ R ), is greater than the union of the knowledge that can be extracted separately from C and R , K ( C ) ⁇ K ( R ).
  • private collection C can contain an arbitrary collection of documents.
  • these documents are not restricted to structured data, such as XML-based documents.
  • collection R is assumed to contain all publicly available documents.
  • R contains all the information publicly available on the Web.
  • a system that facilitates inference detection performs the following two operations. First, the system learns the content of the documents in private collection C . Next, the system determines the inferences that can be drawn from the combination of C and R .
  • the system employs automated content analysis to extract keywords in these documents.
  • the system can use any natural language processing (NLP) tool, ranging from text extraction to in-depth linguistic analysis.
  • NLP natural language processing
  • the system selects keywords based on a "term frequency -inverse document frequency” (TF.IDF) analysis.
  • TF.IDF term frequency -inverse document frequency
  • keyword as used in this disclosure is not limited to a single word, but can include words, phrases, abbreviations, synonyms, or any combination of language symbols.
  • the system assigns each word in a document a TF.IDF weight.
  • the system uses this weight, which is a statistical measure, to evaluate how important a word is to a document in a corpus. The importance of a word increases proportionally to the number of times the word appears in the document, but is offset by the frequency of the word occurrence in the corpus.
  • term frequency n i ⁇ k n k is the number of occurrences of t i in the document, normalized by all the term occurrences in the document.
  • the inverse document frequency, log ⁇ D d : t i ⁇ d is a measure of the general importance of the term and is computed as the logarithm of the number of all documents in the corpus divided by the number of documents containing the term t i .
  • TF.IDF weight is only one example of TF.IDF definition.
  • different TF.IDF definitions can be adopted.
  • embodiments of the present invention can also use other linguistic analysis approaches to derive knowledge from a document.
  • the system issues search queries for documents that match subsets of the keywords previously extracted.
  • the system issues these queries within a reference corpus, such as the public Web, that encapsulates as much of relevant public knowledge as possible.
  • the system parses the documents returned by the search queries for keywords not present in the original private document. Based on these additional keywords, the system can automatically estimate the likelihood of certain inferences. In one embodiment, potentially dangerous inferences are flagged for manual review.
  • FIG. 3 presents an exemplary block diagram illustrating the process of Web-based inference detection in accordance with an embodiment of the present invention.
  • the system first receives a set of private documents 302, which constitute the private collection C , and applies an NLP analysis 304 to private documents 302.
  • the system obtains a set of knowledge representation 306 for private documents 302.
  • knowledge representation 306 includes a number of keywords.
  • corpus 308 includes all the public information on the Web, corpus 308 can also include other format of media.
  • corpus 308 can be all the public court documents, medical records, or all the books in a library.
  • Search engine 312 then returns a number of hits 314.
  • the system performs hit analysis 316 and compares the analysis result with a set of sensitive information 368.
  • the system derives inferences 320, which can be used to redact private documents 302.
  • the inference-detection system described herein illustrates only one embodiment of the present invention.
  • a wide range of NLP tools can be incorporated into the general inference-detection model and achieve the same, if not better, results.
  • the following section describes the inputs, outputs, and parameters of a generic inference-detection model.
  • a private collection of documents C ⁇ C 1 ,..., C n ⁇ , a collection of reference documents R , and a list of sensitive keywords K * that represents sensitive knowledge.
  • Output A list L of inferences that can be drawn from the union of C and R .
  • Each inference is of the form (C i l ,..., C ik ) ⁇ W *, wherein (C i l ,..., C ik ) ⁇ C is a subset of documents in C , and W * ⁇ K * is a subset of sensitive keywords.
  • the inference ( C i l ,..., C ik ) ⁇ W* indicates that the documents (C i l ,...,C ik ), together with the knowledge present in R , allow for inference of the sensitive keywords W*.
  • the output of the system can be a mapping relationship between one or more documents to a piece of sensitive knowledge. The system returns an empty list if it fails to detect any sensitive inference.
  • This inference-detection model is parameterized by four parameters.
  • Parameter a controls the depth of the NLP analysis of the documents in C .
  • Parameters ⁇ and ⁇ control the search depth for documents in R that are related to C .
  • Parameter ⁇ controls the depth of the NLP analysis of the documents retrieved by the search engine.
  • the values of ⁇ , ⁇ , ⁇ , and ⁇ are all positive integers.
  • the system implements and executes the inference-detection model in the following two stages.
  • the system performs a TF.IDF analysis to extract from each document C i in the collection C the top a keywords that are most representative of C i .
  • S i denote the set of the top a keywords extracted from document C i .
  • the list L of inferences is initially empty.
  • the system considers in turn every subset C' ⁇ C of size
  • ⁇ . For every such subset C ' ( C i l ,..., C ik ), with k ⁇ ⁇ , the system performs the following operations. For every vector of keywords ( W i l ,...,W ik ) in the Cartesian product S i l ⁇ ... ⁇ S ik :
  • the system can further use additional queries to gauge, or rank, the strength of the inference between an identified suspicious keyword in the original document and a sensitive keyword, after obtaining the list L .
  • the system computes a sensitive-hits ratio, which in one embodiment is defined as the number of the search hits from a query containing both the suspicious keyword and the sensitive keyword, to the number of search hits from a query containing only the suspicious keyword.
  • the system then ranks the keywords in the original documents according to the strength or severity of their inferences.
  • the system can issue a first query for "naltrexone,” retrieving x documents, and a second query for "naltrexone alcoholism,” retrieving y documents.
  • the system can then calculate the ratio y / x . If this ratio is fairly close to 1, one might decide that naltrexone should be removed from all medical records to avoid inferring a patient's alcoholism condition.
  • the system can also use the aforementioned sensitive-hits ratio computation method as the main approach, instead of an add-on, to identify inferences.
  • the system first extracts the keywords from a set of given private documents using NLP tools. For each keyword extracted from the private documents, the system then computes the sensitive-hits ratio for each extracted keyword with respect to each sensitive word or phrase. If the sensitive-hits ratio between a keyword and a sensitive word or phrase is greater than a given threshold, the system identifies an inference between this keyword and the sensitive word or phrase.
  • the system can also receive a set of sensitive words or phrases and the extracted keyword can include one or more multi-word phrases.
  • the system can extract three phrases, "blood shot eyes,” “memory loss,” and “liver disease,” and compute a sensitive-hits ratio for sensitive words associated with alcoholism, such as “alcoholism,” “alcohol,” “alcoholic,” “drunk,” “drinking.”
  • a sensitive-hits ratio for sensitive words associated with alcoholism, such as “alcoholism,” “alcohol,” “alcoholic,” “drunk,” “drinking.”
  • the system first issues a query for "blood shot eyes memory loss liver disease,” and then a query for "blood shot eyes memory loss liver disease AND (alcoholism OR alcohol OR alcoholic OR drunk OR drinking).”
  • the system then computes the ratio between the number of hits returned by the second query to the number of hits returned by the first query.
  • the system can combine any number of extracted words or phrases in generating the queries.
  • the aforementioned inference-detection model can be tailored to a variety of applications.
  • the system can employ any given logic relationship when formulating queries based on a number of keywords.
  • the examples described herein are based on queries containing space-separated keywords, the system can adopt any Boolean-formulated queries. For example the system can insert "AND” or "OR” between the keywords. With some advanced search engines, the system can also specify how the keywords should appear in the document, such as within a certain number of paragraphs, sentences, or words.
  • the system can also analyze the keywords and formulating the queries based on the analysis. For example, if the system determines that two keywords are synonyms or closely related, the system can optionally insert an "OR" between the keywords when formulating a query.
  • the system can intelligently select different corpora according to the documents under test.
  • the system can also select corpora based on the intended audience.
  • the set of sensitive knowledge K * may not be known or may not be specified. Therefore, the system identifies all possible inferences that arise from knowledge of the collection of documents C and the reference collection R .
  • a variation of the inference-detection model handles this case.
  • the system records all inferences instead of only inferences that involve keywords in K *. Note that this is equivalent to assuming that the set K * of sensitive knowledge includes all knowledge.
  • the system may also track the number of occurrences of each inference, so that the list L can be sorted from the most to the least frequent inference.
  • sensitive knowledge K * is given as a set of keywords.
  • Other representations of sensitive knowledge are also possible.
  • sensitive knowledge may be based on a topic, such as alcoholism or sexually transmitted diseases, instead of a list of keywords.
  • the system performs a pre-processing operation which converts a sensitive topic into a list of sensitive keywords.
  • One way of doing so is to issue a search query for documents in the reference collection R that contain the sensitive topic, and use TF.IDF analysis to extract from these documents an expanded set of sensitive keywords for the sensitive topic.
  • FIG. 4 presents an exemplary flow chart illustrating the process of Web-based inference detection in accordance with an embodiment of the present invention.
  • the system receives a set of private documents (operation 402).
  • the system analyzes these private documents (operation 404) and generates the corresponding search queries (operation 406).
  • a search engine then performs searches on the Web based on these queries and returns a number of hits (operation 408).
  • the system analyzes the hits returned by the search engine (operation 410) and generates keywords from these hits (operation 412). The system then determines whether all hits keywords have been compared with the sensitive words (operation 414). If so, the system outputs the inference records (operation 422) and exits. Otherwise, the system further determines whether the current hits keyword matches any sensitive word (operation 416). If there is a match, the system records the inference (operation 418), and proceeds to the next hits keyword (operation 420). If there is not a match, the system proceeds to the next hits keyword (operation 420).
  • FIG. 5 illustrates a computer system for facilitating Web-based inference detection in accordance with one embodiment of the present invention.
  • a computer system 502 includes a processor 504, a memory 506, and a storage device 508.
  • Computer system 502 is also coupled to a display 514, a keyboard 510, and a pointing device 512.
  • Storage device 508 stores an inference detection application 516, and applications 520 and 522.
  • inference detection application 516 contains a TF.IDF analysis module 518, which performs keyword extraction from documents during inference detection.
  • inference detection application 516 is loaded into memory 506 and executed by processor 504.
  • computer system 502 can be coupled to the Internet, whereby the Web searches are performed by a separate search engine.
  • Redaction of medical records Medical records are often released to third parties such as insurance companies, research institutions or legal counsel in the case of malpractice lawsuits. State and federal legislation mandates the redaction of sensitive information from medical records prior to release. For example, all references to drugs or alcohol, mental health, and HIV status are typically redacted. This redaction task is far more complex than it may initially appear. Extensive and up-to-date knowledge of diseases and drugs is usually required to detect all clues and combinations of clues that may allow for inference of sensitive information. Since this medical information is readily available on public websites, the process of redacting sensitive information from medical records can be partially automated with Web-based inference control.
  • Web-based inference control is perfectly suited to the detection of indirect inferences based on publicly available data. This tools can be used to determine how much information can be released about a person, entity, or event while preserving k-anonymity, that is, ensuring that the sensitive information remains hidden in a group of like-entities of size at least k, and cannot be identified any more precisely within the group.
  • the Web-based inference-detection tools can also be used to pre-compute a set of redaction rules that is later applied to a collection of private documents. For a large collection of private documents, pre-computing redaction rules may be more efficient than using Web-based inference detection to analyze each and every document.
  • executive order 12958 mandated the declassification of large amounts of government data, which include hundreds of millions of pages. Sensitive portions of documents were to be redacted prior to declassification. The redaction rules are exceedingly complex and formulating them is reportedly nearly as time-consuming as applying them.
  • Web-based inference detection is an appealing approach to automatically expand a small set of seed redaction rules. For example, assuming that the keyword "missile" is sensitive, web-based inference detection could automatically retrieve other keywords related to missiles, e.g. "guidance system,” “ballistics,” and “solid fuel,” and add them to the redaction rule.
  • Leak detection This application helps a data owner avoid accidental releases of information that was not previously public.
  • the set of sensitive knowledge K * includes all information that was not previously public. In other words, the release of private data should not add anything to public knowledge.
  • Web-based inference detection is applied to authentic documents for which privacy is a chief concern.
  • a corpus of medical records being prepared for release in response to a subpoena would be ideal for evaluating the ability of these techniques to identify sensitive topics.
  • a corpus is difficult to obtain.
  • a collection of anonymous blogs would be ideal for testing the ability of these techniques to identify individuals, but such blogs are difficult to locate efficiently.
  • the system uses instead publicly available information about an individual, which is anonymized by removing the individual's first and last names.
  • the public information about the individual thus anonymized, appears to be a decent substitute for text that the individual might have authored on their blog or Web page.
  • the system employs Java for extracting text from html, calculation of an extended form of TF.IDF for identifying keywords in documents, and the Google SOAP search API for making Web queries based on those keywords.
  • the exemplary code used herein removes html tags for extracting text from html.
  • the system performs repeated extractions from similarly formatted html pages, such as Wikipedia biographies.
  • the TF.IDF "rank" of a word in a document is defined with respect to a corpus, C. Note that the TF.IDF definition here is slightly different from the one provided previously, thus demonstrating the flexibility in the inference-detection model in terms of adopting different computation methods. The definition is provided as follows.
  • D be a document that contains the word W and is part of the corpus of documents, C.
  • the term frequency (TF) of W with respect to D is the number of times W occurs in D.
  • the document frequency (DF) of W with respect to the corpus, C is the total number of documents in C that contain the keyword W.
  • the TF.IDF value associated with W is the ratio: TF / DF.
  • the system implements a variant of TF.IDF in which the system first uses the British National Corpus (BNC) to stem lexical tokens. For example, the tokens “accuse,” “accused,” “accuses,” and “accusing” would be mapped to the stem “accuse.” The system then uses the BNC again to associate with each token the DF of the corresponding stem, e.g., "accuse” in the earlier example.
  • BNC British National Corpus
  • the goal is to demonstrate how keyword extraction can be used to warn the end-user of impending identification.
  • the inventive inference-detection system accomplishes this goal by constantly amassing keywords from online content proposed for posting by the user (e.g. blog entries) and issuing Web queries based on those keywords. The user is alerted when the hits returned by those queries return their name, and thus is warned about the risk of posting the content.
  • This experiment is based on Wikipedia biographies standing in for user-authored content.
  • the biography subject's name is removed from the biography.
  • the personal content in the biography is viewed as a condensed version of the information an individual might reveal over many posts to their blog, for example.
  • the system extracts keywords and forms queries to Google based on subsets of these keywords.
  • the system searches a portion of the returned hits for the biography subject's name and raises a flag when a hit that is not a Wikipedia page mentions the biography subject. For efficiency reasons, the system limits the portion and number of Web pages to be examined.
  • the experiment includes the following operations:
  • TABLE 1 presents example inferences between keywords, URLs, and biography subjects. These results illustrate that the associations a person has may be as useful for identifying them as their personal attributes. For example, 50% of the first page of hits returned from the search query "nfl nicole goldman francisco pro" are about O. J. Simpson (including the top three hits), but there is no reference to O. J. Simpson in any of the first page of hits returned by the query "nfl francisco pro.” Hence, the association of O. J. Simpson with his wife (Nicole) and his wife's boyfriend (Goldman) is very useful to identifying him in the pool of professional football players who once were members of the San Francisco 49ers.
  • Web-based inference detection Another application of Web-based inference detection is redaction of medical records. It is common practice to redact all information about diseases such as HIV/Aids, mental illness, and drug and alcohol abuse, prior to releasing medical records to a third party, such as a judge in medical malpractice litigation. Implementing such protections today relies on the thoroughness of the redaction practitioner to keep abreast of all the medications, physician names, diagnoses, and symptoms that might be associated with such conditions and practices. Web-based inference detection can be used to improve the thoroughness of this task by automating the process of identifying the keywords allowing such conditions to be inferred.
  • the system takes as input an authoritative page about a certain disease.
  • the system uses Wikipedia to supply pages for alcoholism and sexually transmitted diseases (STDs).
  • STDs sexually transmitted diseases
  • the system then extracts the text from the html, and identifies the keywords.
  • the system issues search queries on subsets of keywords and examines the top hits for references to the associated disease. If such a reference is found, the system records those keywords as being potentially inference-enabling.
  • a redaction practitioner may then use this output to decide what words to redact from the medical records before releasing them to preserve the privacy of the patient. The following describes this experiment in more detail.
  • B is either the Wikipedia page for alcoholism, STDs, or a "control" page of general medical terms.
  • the system performs the above inference detection on a Wikipedia page about STDs, B, and a selected set, B', of 30 keywords from the medical term index available at http://www.medterms.com/script/main.hp.asp.
  • the set B' was selected by starting at the 49th entry in the medical term index and selecting every 400th word in order to approximate a random selection of medical terms. Keyword pairs from input B generate far more hits for STDs (306/435 >70%) than keyword pairs from B' (108/435 ⁇ 25%).
  • the results are summarized in FIG. 9 .
  • the system performs the above inference detection on a Wikipedia page about alcoholism, B , and a selected set, B', of 30 keywords from the medical term index available at http://www.medterms.com/script/main.hp.asp.
  • the set B' was selected by starting at the 52nd entry in the medical term index and selecting every 100th word until 30 were accumulated in order to approximate a random selection of medical terms. Keyword pairs from input B are observed to generate far more hits for alcoholism (47.82%) than B (9.43%).

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Health & Medical Sciences (AREA)
  • Physics & Mathematics (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Medical Informatics (AREA)
  • General Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Mathematical Physics (AREA)
  • Computational Linguistics (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Epidemiology (AREA)
  • Primary Health Care (AREA)
  • Public Health (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
EP08101978A 2007-03-28 2008-02-26 Verfahren und System zur Erkennung unerwünschter Inferenzen von Dokumenten Ceased EP2012241B1 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US11/729,576 US7720783B2 (en) 2007-03-28 2007-03-28 Method and system for detecting undesired inferences from documents

Publications (2)

Publication Number Publication Date
EP2012241A1 true EP2012241A1 (de) 2009-01-07
EP2012241B1 EP2012241B1 (de) 2010-07-28

Family

ID=39734954

Family Applications (1)

Application Number Title Priority Date Filing Date
EP08101978A Ceased EP2012241B1 (de) 2007-03-28 2008-02-26 Verfahren und System zur Erkennung unerwünschter Inferenzen von Dokumenten

Country Status (4)

Country Link
US (1) US7720783B2 (de)
EP (1) EP2012241B1 (de)
JP (1) JP5133745B2 (de)
DE (1) DE602008001924D1 (de)

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US8429225B2 (en) 2008-05-21 2013-04-23 The Invention Science Fund I, Llc Acquisition and presentation of data indicative of an extent of congruence between inferred mental states of authoring users
US8615664B2 (en) * 2008-05-23 2013-12-24 The Invention Science Fund I, Llc Acquisition and particular association of inference data indicative of an inferred mental state of an authoring user and source identity data
US9192300B2 (en) * 2008-05-23 2015-11-24 Invention Science Fund I, Llc Acquisition and particular association of data indicative of an inferred mental state of an authoring user
US8055591B2 (en) * 2008-05-23 2011-11-08 The Invention Science Fund I, Llc Acquisition and association of data indicative of an inferred mental state of an authoring user
US9161715B2 (en) * 2008-05-23 2015-10-20 Invention Science Fund I, Llc Determination of extent of congruity between observation of authoring user and observation of receiving user
US7904507B2 (en) * 2008-05-23 2011-03-08 The Invention Science Fund I, Llc Determination of extent of congruity between observation of authoring user and observation of receiving user
US8001179B2 (en) * 2008-05-23 2011-08-16 The Invention Science Fund I, Llc Acquisition and presentation of data indicative of an extent of congruence between inferred mental states of authoring users
US20090292658A1 (en) * 2008-05-23 2009-11-26 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Acquisition and particular association of inference data indicative of inferred mental states of authoring users
US8086563B2 (en) * 2008-05-23 2011-12-27 The Invention Science Fund I, Llc Acquisition and particular association of data indicative of an inferred mental state of an authoring user
US8082215B2 (en) * 2008-05-23 2011-12-20 The Invention Science Fund I, Llc Acquisition and particular association of inference data indicative of inferred mental states of authoring users
US9101263B2 (en) * 2008-05-23 2015-08-11 The Invention Science Fund I, Llc Acquisition and association of data indicative of an inferred mental state of an authoring user
US8005894B2 (en) * 2008-05-23 2011-08-23 The Invention Science Fund I, Llc Acquisition and presentation of data indicative of an extent of congruence between inferred mental states of authoring users
US7979413B2 (en) * 2008-05-30 2011-07-12 At&T Intellectual Property L, L.P. Automatic generation of embedded signatures for duplicate detection on a public network
US8839443B2 (en) * 2008-10-16 2014-09-16 At&T Intellectual Property I, L.P. Identifying and remedying secondary privacy leakage
US8566350B2 (en) * 2009-11-02 2013-10-22 Palo Alto Research Center Incorporated Method and apparatus for facilitating document sanitization
JP5460359B2 (ja) * 2010-01-29 2014-04-02 インターナショナル・ビジネス・マシーンズ・コーポレーション 文書中の文字列の処理を支援するための装置、方法及びプログラム
US20110282862A1 (en) * 2010-05-14 2011-11-17 Telcordia Technologies, Inc. System and method for preventing nformation inferencing from document collections
SG10201506319WA (en) 2010-08-12 2015-09-29 Mastercard International Inc Multi-commerce channel wallet for authenticated transactions
WO2014133825A1 (en) 2013-03-01 2014-09-04 3M Innovative Properties Company Classifying medical records for identification of clinical concepts
US9405822B2 (en) 2013-06-06 2016-08-02 Sheer Data, LLC Queries of a topic-based-source-specific search system
US9219746B2 (en) * 2013-08-30 2015-12-22 Bank Of America Corporation Risk identification based on identified parts of speech of terms in a string of terms
US9330166B2 (en) 2013-11-12 2016-05-03 International Business Machines Corporation User-specific search over protected contextual data
CN104933443A (zh) * 2015-06-26 2015-09-23 北京途美科技有限公司 一种敏感数据自动识别与分类的方法
EP3516566A1 (de) 2016-09-22 2019-07-31 nference, inc. Systeme, verfahren und computerlesbare medien zur visualisierung von semantischen informationen und ableitung von zeitlichen signalen zum hinweis auf prägnante zusammenhänge zwischen biowissenschaftsentitäten
US10372799B2 (en) * 2017-05-03 2019-08-06 Veritone, Inc. System and method for redacting content
US11010492B1 (en) * 2018-09-10 2021-05-18 NortonLifeLock Inc. Real-time detection of privacy leaks based on linguistic features
US11205010B2 (en) * 2018-09-10 2021-12-21 NortonLifeLock Inc. Systems and methods for identifying privacy leakage information
US11170017B2 (en) 2019-02-22 2021-11-09 Robert Michael DESSAU Method of facilitating queries of a topic-based-source-specific search system using entity mention filters and search tools
US12333393B2 (en) 2019-06-21 2025-06-17 nference, inc. Systems and methods for adaptively improving the performance of locked machine learning programs
WO2020257783A1 (en) 2019-06-21 2020-12-24 nference, inc. Systems and methods for computing with private healthcare data
US11487902B2 (en) 2019-06-21 2022-11-01 nference, inc. Systems and methods for computing with private healthcare data
US12032546B2 (en) 2019-07-16 2024-07-09 nference, inc. Systems and methods for populating a structured database based on an image representation of a data table
JP7096222B2 (ja) * 2019-09-30 2022-07-05 Kddi株式会社 リスク評価装置、リスク評価方法及びリスク評価プログラム
US11423094B2 (en) * 2020-06-09 2022-08-23 International Business Machines Corporation Document risk analysis
WO2022081712A1 (en) * 2020-10-14 2022-04-21 nference, inc. Systems and methods for retrieving clinical information based on clinical patient data
WO2023069395A1 (en) 2021-10-18 2023-04-27 Clearbrief, Inc. System, method, and computer program product for identifying events and representing a plurality of events in an interactive graphical user interface
WO2023081795A1 (en) 2021-11-05 2023-05-11 nference, inc. Method and system for determining relationships between linguistic entities

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6076051A (en) * 1997-03-07 2000-06-13 Microsoft Corporation Information retrieval utilizing semantic representation of text
JP3928351B2 (ja) * 2000-11-16 2007-06-13 株式会社日立製作所 確率を用いた特徴単語の選択方法
JP3456643B2 (ja) * 2000-12-14 2003-10-14 株式会社日立情報システムズ 意見収集配信サーバと意見収集配信プログラムを記録した記録媒体
US7031969B2 (en) * 2002-02-20 2006-04-18 Lawrence Technologies, Llc System and method for identifying relationships between database records
JP4533577B2 (ja) * 2002-09-13 2010-09-01 株式会社東芝 データ読み出し管理プログラム及びシステム及び方法
JP2006309737A (ja) * 2005-03-28 2006-11-09 Ntt Communications Kk 開示情報提示装置、個人特定度算出装置、ｉｄ度取得装置、アクセス制御システム、開示情報提示方法、個人特定度算出方法、ｉｄ度取得方法、及びプログラム

Non-Patent Citations (8)

* Cited by examiner, † Cited by third party
Title
C FARKAS ET AL.: "The inference problem: a survey", ACM SIGKDD EXPLORATIONS NEWSLETTER, vol. 4, no. 2, December 2002 (2002-12-01), pages 6 - 11, XP002495620, DOI: doi:10.1145/772862.772864
C. FARKAS ET. AL: "The inference problem: a survey", ACM SIGKDD EXPLORATIONS NEWSLETTER, vol. 4, no. 2, December 2002 (2002-12-01), pages 6 - 11, XP002495620, ISSN: 1931-0145, Retrieved from the Internet <URL:http://doi.acm.org/10.1145/772862.772864> [retrieved on 20080912] *
GAUCH ET AL: "A CORPUS ANALYSIS APPROACH FOR AUTOMATIC QUERY EXPANSION AND ITS EXTENSION TO MULTIPLE DATABASES", ACM TRANSACTIONS ON INFORMATION SYSTEMS, ACM, NEW YORK, NY, US, vol. 17, no. 3, 1 July 1999 (1999-07-01), pages 250 - 269, XP000865354, ISSN: 1046-8188 *
GAUCHE ET AL.: "ACM TRANSACTIONS ON INFORMATION SYSTEMS", vol. 17, 1 July 1999, ACM, article "A CORPUS ANALYSIS APPROACH FOR AUTOMATIC QUERY EXPANSION AND ITS EXTENSION TO MULTIPLE DATABASES", pages: 250 - 269
HALE J ET AL.: "Catalytic inferences analysis: detecting inference threats due to knowledge discovery", SECURITY AND PRIVACY, 1997. PROCEEDINGS., 1997 IEEE SYMPOSIUM ON OAKLAND, CA, USA 4-7 MAY 1997, LOS ALAMITOS, CA, USA, IEEE COMPUT. SOC, US, 4 May 1997 (1997-05-04), pages 188 - 199
HALE J ET AL: "Catalytic inference analysis: detecting inference threats due to knowledge discovery", SECURITY AND PRIVACY, 1997. PROCEEDINGS., 1997 IEEE SYMPOSIUM ON OAKLAND, CA, USA 4-7 MAY 1997, LOS ALAMITOS, CA, USA,IEEE COMPUT. SOC, US, 4 May 1997 (1997-05-04), pages 188 - 199, XP010230155, ISBN: 978-0-8186-7828-8 *
YU CHEN ET AL.: "INTELLIGENCE AND SECURITY INFORMATICS LECTURE NOTES IN COMPUTER SCIENCE; LNCS", vol. 3975, 1 January 2006, SPRINGER, article "Database Security Protection Via Inference Detection", pages: 452 - 458
YU CHEN ET AL: "Database Security Protection Via Inference Detection", INTELLIGENCE AND SECURITY INFORMATICS LECTURE NOTES IN COMPUTER SCIENCE;;LNCS, SPRINGER, BERLIN, DE, vol. 3975, 1 January 2006 (2006-01-01), pages 452 - 458, XP019033806, ISBN: 978-3-540-34478-0 *

Also Published As

Publication number Publication date
US20080243825A1 (en) 2008-10-02
JP5133745B2 (ja) 2013-01-30
JP2008243205A (ja) 2008-10-09
US7720783B2 (en) 2010-05-18
EP2012241B1 (de) 2010-07-28
DE602008001924D1 (de) 2010-09-09

Similar Documents

Publication Publication Date Title
EP2012241B1 (de) Verfahren und System zur Erkennung unerwünschter Inferenzen von Dokumenten
US8458179B2 (en) Augmenting privacy policies with inference detection
US8457416B2 (en) Estimating word correlations from images
US20140365502A1 (en) Determining Answers in a Question/Answer System when Answer is Not Contained in Corpus
US20090070322A1 (en) Browsing knowledge on the basis of semantic relations
Staddon et al. Web-Based Inference Detection.
US20100114574A1 (en) Retrieval using a generalized sentence collocation
CN104268192B (zh) 一种网页信息提取方法、装置及终端
Wang et al. Improving question answering for event-focused questions in temporal collections of news articles
Dagher et al. Subject-based semantic document clustering for digital forensic investigations
US20110289081A1 (en) Response relevance determination for a computerized information search and indexing method, software and device
Alani Automatic extraction of knowledge from web documents
Babekr et al. Personalized semantic retrieval and summarization of web based documents
US7757163B2 (en) Method and system for characterizing unknown annotator and its type system with respect to reference annotation types and associated reference taxonomy nodes
Sarwar et al. Term relevance feedback for contextual named entity retrieval
Leal Bando et al. Query‐biased summary generation assisted by query expansion
Zhang et al. Weighted ontology-based search exploiting semantic similarity
Thom et al. Use of Wikipedia categories in entity ranking
Inoue et al. Retrieving lightly annotated images using image similarities
Kong et al. Proximity-based traceability: An empirical validation using ranked retrieval and set-based measures
Nastase et al. A study of two graph algorithms in topic-driven summarization
Sakre et al. Weighting query terms using wordnet ontology
Wochna Electronic Data, Electronic Searching, Inadvertent Production of Privileged Data: A Perfect Storm
Provost et al. Improved document summarization and tag clouds via singular value decomposition
Moldovan et al. Some Advanced Features Of Cc's Poweranswer

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL BA MK RS

17P Request for examination filed

Effective date: 20090707

AKX Designation fees paid

Designated state(s): DE FR GB

17Q First examination report despatched

Effective date: 20090819

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): DE FR GB

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REF Corresponds to:

Ref document number: 602008001924

Country of ref document: DE

Date of ref document: 20100909

Kind code of ref document: P

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20110429

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602008001924

Country of ref document: DE

Effective date: 20110429

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 9

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 10

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 11

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602008001924

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: G06F0017300000

Ipc: G06F0016000000

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20200123

Year of fee payment: 13

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20200122

Year of fee payment: 13

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20210226

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210228

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20210226

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20230119

Year of fee payment: 16

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 602008001924

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20240903

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20240903